PT-2025-32384

CVE-2025-55003

Published

2025-08-08

Updated

2026-07-27

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below

Description OpenBao’s Login Multi-Factor Authentication (MFA) system, utilizing Time-based One Time Password (TOTP), accepted codes containing whitespace due to normalization applied by the underlying TOTP library. This bypassed internal rate limiting, allowing reuse of existing MFA codes.

Recommendations Upgrade to version 2.3.2 to resolve this issue. Utilize rate-limiting quotas to limit potential exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Cipherboy

Vendors

Affected products

Weakness enumeration

CWE-307: Improper Restriction of Excessive Authentication Attempts

Related identifiers